🚨 HIGH - Unauthenticated stored XSS in Email Address Encoder email replacement (CVE-2026-5305) A stored cross-site scripting flaw exists in the Email Address Encoder WordPress plugin and its email-encoder-premium counterpart due to unsafe handling of email replacement output. The root cause is improper input validation/output encoding, allowing attacker-controlled content to be persisted and rendered as script. An attacker can exploit this remotely without authentication by injecting crafted payloads that get stored during the plugin’s email replacement process and later served to visitors/admins. Impact includes arbitrary JavaScript execution in victims’ browsers, leading to admin session hijack, malicious redirects, and potential site takeover via chained admin actions. 👉 Affected: Email Address Encoder < 1.0.25; email-encoder-premium < 0.3.12 | Upgrade to Email Address Encoder 1.0.25 / email-encoder-premium 0.3.12
Post summary
The post announces a stored XSS flaw in the Email Address Encoder WordPress plugin (CVE-2026-5305), with technical details indicating unauthenticated attack vectors and recommended patches, but no PoC, exploit tool, or active exploitation evidence.
